CVE-2022-24736 A Malformed Lua script can crash Redis
An attacker can crash the Redis server by loading a specially crafted Lua script, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24736?
CVE-2022-24736 is a low-severity vulnerability in Fedoraproject Fedora, published on 27 Apr 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
Weakness: CWE-476
Which versions are affected by CVE-2022-24736?
3 open source packages ship an affected version, including keydb, redis and valkey. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
keydb Bitnami | All versions | 6.2.7 |
redis Bitnami | All versions | 6.2.7 |
valkey Bitnami | All versions | 6.2.7 |
Products include Fedoraproject Fedora, Netapp Management Services for Element Software, Netapp Management Services for Netapp Hci, Oracle Communications Operations Monitor, Redis Redis.
How do I fix CVE-2022-24736?
Upgrade keydb to 6.2.7 or later.
Is CVE-2022-24736 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24736 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2022-24736, AZL-45357, AZL-71176, AZL-9599, BIT-keydb-2022-24736, BIT-redis-2022-24736 and 5 more.